CVE-2023-32637

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Generic Model Organism Database Project	GBrowse	unspecified

References

http://gmod.org/wiki/GBrowseProduct
https://jbrowse.org/jb2/Not Applicable
https://jvn.jp/en/jp/JVN35897618/Third Party Advisory
http://gmod.org/wiki/GBrowseProduct
https://jbrowse.org/jb2/Not Applicable
https://jvn.jp/en/jp/JVN35897618/Third Party Advisory

Timeline

Published: Jul 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-326387.8Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially e CVE-2023-326395.5Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML fi CVE-2023-32649.8The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal CVE-2023-326418.8Improper input validation in firmware for Intel(R) QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of s CVE-2023-326426.5Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.24 CVE-2023-326437.8A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665 CVE-2023-326446.5Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an una CVE-2023-326459.8A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted ne CVE-2023-326467.3Uncontrolled search path element in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially ena CVE-2023-326477.8Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalat CVE-2023-326497.5A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the CVE-2023-32659.8An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an at